T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/request.js:68- Finding
API Token Exposed in URL Query Strings
- Content
View full analysis
- Remediation
View remediation
Security audit
guaikei-search
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does the Xiaohongshu data lookups it describes, but it handles an API token in a way that can expose it in request URLs and should be reviewed before installation.
Review before installing. Use this only if you are comfortable sending Xiaohongshu query/link data and your Guaikei API token to www.guaikei.com, and be aware that the current code may expose the token in URL logs. Prefer a scoped, revocable token, rotate it if it has already been used, and review local logs because fetched public data is saved under the skill's logs directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (54)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill performs keyword-based Xiaohongshu note search with filtering and sorting options. The supplied code does not implement keyword search at all. Instead, it creates and retrieves a note detail/comment task for a specific note URL, including optional comment count, and post-processes returned detail data to construct note and profile links. This is a materially different primary purpose, so the description does not accurately represent the behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill searches Xiaohongshu public notes by keyword with multiple filters and sorting options. The supplied code does something materially different: it creates and queries a task using a blogger URL via endpoints '/api/xiaohongshu/post/url' and '/api/xiaohongshu/post/info'. Parameters are only token, url, and limit. There is no keyword parameter, no note-type filter, no sort option, and no time-range option. The module comment also states it is for '博主详情、已发布笔记模块' (blogger details / published notes). This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose describes an end-user search capability against Xiaohongshu public notes, including specific filtering and result-return behavior. However, the supplied code chunk does not perform any search, scraping, API calls, or result processing. It is only a reusable utility for parsing command-line arguments and generating help text. While such parsing could support a search CLI, this chunk by itself does not implement the declared functionality. Therefore, the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose centers on searching Xiaohongshu public notes and returning filtered/sorted results. The actual code chunk is limited to token management: checking token format, printing status/error messages, and returning the token or an empty string. This is materially different from the declared functionality because none of the search, filtering, sorting, or data retrieval behavior is present in the supplied code. While token handling could be a supporting detail in a larger system, this specific chunk does not match the declared purpose and instead performs configuration validation plus promotional messaging.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose describes a search/retrieval capability for Xiaohongshu public notes, including filtering and result return behavior. The supplied code does not implement any search, network access, platform interaction, filtering, sorting, or result parsing. Instead, it validates inputs, sanitizes a filename, creates directories, and writes content to a local log file. This is a materially different primary purpose and introduces filesystem write access that is not reflected in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a search capability over Xiaohongshu public notes with keyword query support, filters, sort orders, time windows, and bulk result return including metadata. The actual code chunk does not perform any search, querying, scraping, or result extraction. It only validates whether a supplied URL matches note/profile patterns and converts URLs into normalized names. This is a materially different primary purpose from the declared functionality, so it is a clear mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill performs keyword-based Xiaohongshu note search with multiple filtering and sorting options. The supplied code does something materially different: it is a detail/comment retrieval CLI for a single public note identified by URL. It validates note URLs, limits comment count, calls detail-task APIs, and returns task results for that note. None of the declared search capabilities—keyword input, type filtering, sorting, or time-range filtering—are implemented in this code chunk. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill performs keyword-based Xiaohongshu note search with multiple filtering and sorting options. The code instead defines a CLI that requires a Xiaohongshu blogger/profile URL (
--url) and an optional result limit, validates that the URL is a profile link, then creates and fetches a 'post' task for that profile. All user-facing text refers to '博主链接' and '主页笔记数量', confirming the purpose is retrieving posts from a specific blogger homepage. None of the declared keyword search capabilities or filters appear in this code chunk. This is a material purpose mismatch, not just an implementation detail.- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "分析这条小红书笔记评论区的主要观点和负面反馈: node src/xiaohongshu/detail-cli.js --url 'https://www.xiaohongshu.com/explore/xxx?xsec_token=yyy' --limit 100"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - "看这个小红书博主最近 20 条作品都在发什么: node src/xiaohongshu/post-cli.js --url 'https://www.xiaohongshu.com/user/profile/xxx?xsec_token=yyy' --limit 20"
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill performs keyword search over public Xiaohongshu notes with filters like content type, sort order, and time range. In contrast, this file is documented and implemented as a '博主详情、已发布笔记模块' that creates and queries tasks using a blogger URL to fetch a creator's published posts, which is a materially different capability from keyword search.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This CLI implements profile-post collection by accepting a Xiaohongshu profile URL, which materially differs from the stated skill purpose of keyword-based public note search. That mismatch is security-relevant because it expands the skill's data-access behavior beyond what users and reviewers would reasonably expect, enabling undisclosed collection of a user's full public posting history.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code calls createPostTask and getPostTask for homepage posts instead of performing the manifest-described keyword search workflow. This is dangerous because the runtime behavior is hidden behind a misleading skill description, which can bypass user intent and platform review expectations while collecting a different class of data than advertised.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description, examples, headings, instructions, and support information are written entirely in Chinese, and the recommended trigger phrases are also Chinese-only. For a general-purpose skill, this constitutes a locale/language constraint that is not documented as optional or region-specific, and no alternative language choice is offered.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest context for this skill says it performs keyword search over public Xiaohongshu notes with filtering and sorting. In contrast, the package description and keywords claim broader capabilities such as competitor monitoring, KOL screening, user profiling, and marketing growth analytics, which materially exceed a simple search skill's stated scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill description, usage instructions, warnings, and support information are presented only in Chinese, with no indication that other languages are supported or that the Chinese-only requirement is intentional and justified. This can violate language/locale policy when users are not given an explicit choice or opt-in for a single-language experience.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README frames the skill as a broad Xiaohongshu data-mining platform for competitor monitoring, KOL screening, and trend prediction, which exceeds the stated keyword-search description. Overstating capability can conceal the real operational scope and lead to inappropriate deployment, weak review, or misuse for surveillance-like marketing intelligence.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises note detail, comment retrieval, and creator post monitoring that go beyond the declared keyword-search scope in the manifest. This creates a scope-transparency problem: reviewers and users may authorize or trust the skill for a narrow function while it is positioned to support materially broader data collection workflows.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The changelog advertises capabilities beyond the declared keyword-search scope, including note-detail retrieval, comment sentiment analysis, and creator monitoring. This creates a scope mismatch that can mislead users, reviewers, or calling agents about what the skill may do, weakening trust boundaries and potentially enabling unexpected collection or processing of additional public profile and engagement data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation advertises three capabilities—keyword search, note detail/comments retrieval, and creator post retrieval—while the manifest describes only a keyword-search skill. This scope mismatch can cause downstream agents or reviewers to invoke data-access behaviors that were not declared, weakening trust boundaries and making hidden or unreviewed functionality easier to slip into production.
- Content